Backscatter from using "suspend outgoing email" in the API
Hi I am having a quite awful problem with backscatter. You see not long ago we started using the WHM api to suspend outgoing email for an account instead of suspending the whole account, especially if the spamming was being caused by a poorly thought out (old) webform) that sends a copy to the sender.
This has been going great until about 1-2 weeks ago we noticed our outgoing MTA was going way over the limit (we are using Mailchannels smart host for outgoing mail) upon further investigation it seems that two users that I suspended the mail on were the culprit, before suspending their outgoing mail they were being limited by hourly quotas to about 100 mails per hour, but after I blocked them the bounces were not being rate limited (being sent back to the "sender" or rather from address of the form) and were sending tens of thousands of emails every hour and since the from adress was an external address that mail went through the outgoing smarthost. The only solution found was to completely suspend the account and ask them to remove or fix the form.
Now I thinks it's of great value to be able to suspend only a part of the services, we have even developed a plugin to allow administrators to use this function through WHM's gui but with this being the risk we can't really risk using this at all.
Since we don't offer the built in cpanel mail accounts we don't really need these bounces at all (no inboxes on the servers so they shouldn't need to bounce) so ideally I would like to completely disable bounce emails. Or at least for this case. I found an old thread about disabling "Disk Quota Delivery Failure" responses and I see that is available in the Dovecot configuration:
56569
What I would like to do is:
a) disable delivery failure responses altogether
or b) disable delivery failure responses for outgoing mail suspended.
Like I said, if the mail is coming from a local mail user that report makes perfect sense but I don't have any local mail accounts so it will always be sent in reply to an external domain that doesn't make sense.
B.R. Haddi
-
Here is an example: 56577 All these mails (and a few hundred thousand more) caused a bounce mail to be sent to the from address that is not on our server (office365) 0 -
Hi @Hafsteinn Heimisson This is showing the message is being discarded after submission. It's not showing a bounce, can you show an example of the bounce message? 0
Please sign in to leave a comment.
Comments
2 comments